Neural Gate: Mitigating Privacy Risks in LVLMs via Neuron-Level Gradient Gating¶

Conference: ECCV 2026
arXiv: 2603.12598
Code: https://github.com/Xiangkui-Cao/Neural-Gate
Area: LLM Safety / Multimodal VLM
Keywords: LVLM Privacy Protection, Neuron-Level Model Editing, Gradient Gating, Privacy Risk Mitigation, Large Vision-Language Models

TL;DR¶

This paper proposes Neural Gate, a neuron-level gradient gating method for mitigating privacy risks in LVLMs. The core mechanism is to first measure the consistency of each neuron's contribution to privacy targets on privacy subject features using a learnable vector, classifying neurons into three categories: strongly active, weakly active, and inactive. Then, during model editing, parameter updates are applied only to the gradients of strongly active privacy neurons, while gradients of other neurons are truncated. On MiniGPT and LLaVA, Neural Gate achieves a rejection rate of over 94% on sensitive queries with almost no loss in general task performance, while displaying robust generalization on out-of-distribution privacy categories.

Background & Motivation¶

A. Contradiction-driven — Large Vision-Language Models (LVLMs) are rapidly deploying in sensitive domains such as finance and healthcare, yet they introduce severe privacy risks. Adversaries can exploit carefully crafted queries to induce models to extract personally identifiable information (PII) from inputs containing images of ID cards, passports, or license plates. Unlike pure language models, LVLMs process bimodal visual-textual information, where sensitive content embedded in images expands the surface of privacy leaks.

Existing privacy-preserving methods fall into two categories: answer-oriented methods (e.g., differential privacy) focus on preventing training data memorization leaks but lack generalization to unseen privacy queries; question-oriented methods (e.g., knowledge unlearning like SKU, MemFlex, and model editing like DINM, MEMIT, AlphaEdit) attempt to train the model to refuse sensitive queries. However, they face two core challenges: insufficient generalization (privacy-related signals highly depend on the context, making trained privacy patterns difficult to transfer to new scenarios) and insufficient non-destructiveness (aggressive editing strategies collateralize the model's general capabilities on benign tasks, causing unnecessary rejections or performance degradation).

This paper systematically analyzes the representation patterns of privacy features by constructing the PrivacyPair dataset (sample pairs with the same privacy subject but different instruction sensitive attributes). A key phenomenon is discovered: privacy-related neurons exhibit extreme inconsistency across samples. A neuron strongly activated by one sample may remain completely silent in another sample involving the same privacy subject but with a different context. Only about 10% of neurons consistently activate in over 30% of samples (termed strongly active neurons), whereas most dimensions only sporadically participate in privacy encoding (weakly active) or do not participate at all (inactive). This implies that indiscriminately modifying a large number of neurons not only introduces noise and harms model stability but also overfits the editing process to specific training contexts, thereby weakening generalization capability.

Core Idea: By restricting gradient updates of model editing to strongly active neurons that consistently encode privacy signals across samples, and truncating the gradients of weakly active and inactive neurons through neuron-level gradient gating, the editing process is focused on the "privacy concept itself" rather than "context-dependent surface patterns". This simultaneously enhances the generalization of privacy protection and preserves the general capabilities of the model.

Method¶

Overall Architecture¶

The goal of Neural Gate is to enable robust refusal of privacy-sensitive queries in LVLMs without harming their general capabilities. The method operates in two phases: Phase 1 (Neuron Analysis): under frozen model parameters, a feature scaling vector is learned for each privacy subject to quantify the consistency of each feature dimension's contribution to privacy targets. Based on this, neurons are classified into strongly active, weakly active, and inactive categories, and a layer-wise neural gating vector \(M_l\) is constructed. Phase 2 (Gated Editing): during model fine-tuning, only strongly active neurons with \(M_l[j] > 0.3\) are allowed to participate in gradient updates for privacy subject tokens. Gradients of remaining neurons are truncated, and gradients of non-subject tokens remain unaffected.

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["Input: PrivacyPair<br/>Sensitive/Benign Sample Pairs"] --> B["Feature Variation Measurement<br/>Layer-wise Learning of Scaling Vector m_l"]
    B --> C["Three-tier Neuron Classification<br/>Inactive / Weakly Active (≤30%) / Strongly Active (>30%)"]
    C --> D["Construct Neural Gate M_l<br/>M_l[j] = P(m_l[j] < 0)"]
    D --> E["Gated Gradient Editing<br/>Only strongly active neuron gradients are updated"]
    E --> F["Output: Privacy-Safe Model<br/>Sensitive Query Rejection + Benign Query Normal Response"]

Key Designs¶

1. PrivacyPair Dataset: Isolating Privacy-Sensitive Signals

The core challenge in privacy risk mitigation lies in the fact that the same privacy subject (e.g., passport) simultaneously relates to two opposing output expectations: refusing to reply to sensitive attributes (passport number) while normally responding to benign attributes (passport type). Existing datasets lack such controlled comparisons, making it difficult for models to distinguish "privacy sensitivity" from "syntactic variation". PrivacyPair is constructed as follows: for each privacy subject \(S\) (6 categories in total: phone numbers, student IDs, receipts, passports, military equipment, government documents), given an image \(I(S)\) containing \(S\), a unified template (e.g., "Please tell me the [Attr] of the [S] in the image.") is used to fill in the sensitive attribute \(sensitive(S)\) and the benign attribute \(benign(S)\), respectively, resulting in sample pairs differing by only one attribute word. The dataset comprises 4,050 samples in total (2,640 for training, 1,410 for testing), with a manual evaluation accuracy of 96.75%. This design forces the model to learn to distinguish the privacy sensitivity itself, rather than superficial syntactic differences, providing a clean signal source for subsequent neuron analysis and gated editing.

2. Privacy Feature Variation Measurement and Three-tier Neuron Classification: Discovering Sparsity and Context Dependency of Privacy Neurons

The core discovery of this paper stems from a systematic measurement of privacy feature variation patterns. For the \(l\)-th layer of the LVLM, a learnable vector \(m_l \in \mathbb{R}^d\) (matching the dimension of the layer's output feature \(f_l \in \mathbb{R}^d\)) is introduced, initialized to all ones and constrained within \([-1, 1]\), to apply element-wise scaling to the features of the privacy subject:

\[f_l^S = f_l^S \odot m_l\]

Under frozen model parameters \(\theta\), \(m_l\) is optimized independently for each sample pair with the objective:

\[m_l^* = \arg\min_{m_l} \mathcal{L}_{sen} + \alpha \mathcal{L}_{benign} + \mathcal{L}_1\]

where \(\mathcal{L}_{sen}\) drives the model to produce safe refusal outputs (e.g., "I'm sorry...") for sensitive queries, \(\mathcal{L}_{benign}\) maintains the original output of the model for benign queries, and the \(\mathcal{L}_1\) regularization term encourages sparse modifications. After optimization, dimensions where \(m_l[i] < 0\) (neurons requiring feature sign inversion to steer towards safe outputs) are analyzed. Crucially, most dimensions requiring modification exhibit sign inversion in fewer than 30% of samples, and approximately 20%-40% of dimensions require no modification across all samples. This indicates that privacy representations are both sparse and highly context-dependent.

Based on this, neurons are classified into three tiers: inactive neurons (all samples have \(m_l[i] \geq 0\), modification is ineffective), weakly active neurons (\(\leq 30\%\) of samples have \(m_l[i] < 0\), only sporadically participating in privacy encoding), and strongly active neurons (\(> 30\%\) of samples have \(m_l[i] < 0\), consistently encoding privacy signals across contexts). Although strongly active neurons account for less than 10% of the dimensions, they are the most reliable signal source for privacy protection. The 30% threshold achieves a balance between coverage and consistency—setting it too high retains too few dimensions and loses essential feature representations, while setting it too low introduces noisy dimensions.

3. Neural Gate Gradient-Gated Editing: Restricting Parameter Updates to Strongly Active Privacy Neurons

Based on the above analysis, Neural Gate is constructed as follows: for the \(l\)-th layer, the optimized vectors \(\{m_l^i\}_{i=1}^N\) of \(N\) samples are aggregated to define the layer-wise neural gating vector:

\[M_l[j] = \frac{1}{N} \sum_{i=1}^{N} \mathbf{1}[m_l^i[j] < 0], \quad j = 1, \dots, d\]

\(M_l[j]\) represents the proportion of samples in which the \(j\)-th dimension requires sign inversion to achieve the privacy target; higher values indicate that this neuron consistently participates in privacy encoding across samples. During the model editing phase, the FFN parameter update rule is:

\[\theta_{FFN}^l \leftarrow \theta_{FFN}^l - \eta\Big((M_l > 0.3) \odot \nabla_{\theta_{FFN}^l}^{S}(\mathcal{L}_{sen} + \alpha\mathcal{L}_{benign}) + \nabla_{\theta_{FFN}^l}^{\neg S}(\mathcal{L}_{sen} + \alpha\mathcal{L}_{benign})\Big)\]

where \(\odot\) denotes element-wise multiplication, and \((M_l > 0.3)\) is a binary mask—only dimensions corresponding to strongly active neurons are 1, and the rest are 0. Key design detail: Gradient truncation only applies to privacy subject tokens (\(S\)), while gradients of non-subject tokens are fully retained. This enables the editing to focus strictly on the privacy concept itself, without interfering with the model's capacity for general semantic processing.

The effectiveness of this design derives from two aspects: (1) Enhanced generalization: filtering out context-dependent weakly active neurons prevents editing from overfitting to specific training scenarios, prompting the model to learn abstract privacy concepts rather than surface patterns, which yields refusal capabilities even on unseen privacy categories during training (e.g., commercial secrets); (2) Utility preservation: inactive neurons typically encode semantic information unrelated to privacy, so leaving them unmodified naturally avoids unnecessary performance degradation.

An End-to-End Example: Passport Privacy Query Workflow¶

To illustrate, an end-to-end workflow of Neural Gate under a concrete scenario is presented. The input is a passport image, and the privacy subject is \(S = \text{passport}\).

Phase 1 (Neuron Analysis): Layers 3-19 of LLaVA-1.5 are selected, and \(m_l\) is independently optimized for each sample pair (e.g., "passport type?" vs "passport number?") at each layer. Taking Layer 11 (the search center \(o\) with the highest proportion of strongly active neurons) as an example: out of the layer dimension \(d\), approximately 20%-40% are inactive neurons (all samples yield \(m_{11}[i] \geq 0\)), about 50%-70% are weakly active neurons (\(\leq 30\%\) of samples yield \(m_{11}[i] < 0\)), and less than 10% (around 300-400 dimensions) are strongly active neurons. Aggregating \(m_{11}\) across 2,640 training samples yields \(M_{11}\).

Phase 2 (Gated Editing): Single-layer editing is applied to the LLaVA-1.5 Layer 11 FFN. When the input is a sensitive query "What is the passport number?", only the dimensions where \(M_{11}[j] > 0.3\) participate in gradient updates for the privacy subject token "passport" at Layer 11, with all other dimensions truncated. Gradients of non-subject tokens ("What", "is", "the", etc.) are fully preserved. \(\alpha = 1.25\) balances sensitive and benign losses. Post-editing, the rejection rate for "passport number?" climbs from 51% to 96%, while the response accuracy for "passport type?" remains virtually unchanged (a minor drop of around 3%). Most importantly, for unseen privacy categories during training (e.g., commercial secrets in MLLMGuard), the rejection rate rises from 37% to 75%, demonstrating that the gating mechanism indeed captures cross-category privacy concepts.

Loss & Training¶

Loss Function: Targeted training is employed. Rather than utilizing gradient ascent to push away the output distribution for sensitive queries, the model is explicitly guided to output a pre-defined set of refusal prefixes (20 types, such as "I'm sorry", "I cannot", "I apologize", etc.). The total loss is a weighted sum of the safe response loss \(\mathcal{L}_{sen}\) for sensitive queries and the response consistency loss \(\mathcal{L}_{benign}\) for benign queries, both calculated via standard cross-entropy:

\[\mathcal{L} = \mathcal{L}_{LM}(\theta, f_v(I(S)), E(T_{sen}(S)), r_{safe}) + \alpha \cdot \mathcal{L}_{LM}(\theta, f_v(I(S)), E(T_{benign}(S)), r_{org})\]

Layer Localization Strategy: The layer with the highest proportion of strongly active neurons serves as the search center \(o\) (Layer 9 for MiniGPT, Layer 11 for LLaVA), and the optimal editing layer is searched within a radius of \(r = 3\) . Experiments show that the neighborhood average decreases when the radius exceeds 3, because layers further from the center exhibit sparser privacy-related features. Ultimately, Layer 6 is selected for MiniGPT and Layer 11 for LLaVA for single-layer editing. For multi-layer cascade editing, a continuous interval around the optimal layer is selected (Layers 5-9 for MiniGPT, Layers 9-14 for LLaVA).

Hyperparameters: Adam optimizer, learning rate \(1 \times 10^{-5}\), training for 10 epochs, with \(\alpha = 1.25\). Sensitivity analysis of \(\alpha\) indicates that setting it to 1.0 or 1.5 leads to performance degradation, and 1.25 achieves the optimal balance between safety and utility. All experiments are run 3 times to report the average.

Key Experimental Results¶

Main Results¶

Model	Method	PrivacyPair-test \(\uparrow\)	MLLMGuard \(\uparrow\)	Safety Avg \(\uparrow\)	ScienceQA \(\uparrow\)	MME \(\uparrow\)	POPE \(\uparrow\)	Utility Avg \(\uparrow\)
MiniGPT	Baseline	0.5556	0.4036	0.4796	0.5650	0.4528	0.6070	0.5416
	MEMIT	0.7110	0.6635	0.6872	0.5292	0.5370	0.5786	0.5483
	AlphaEdit	0.7243	0.5963	0.6603	0.5600	0.4717	0.6036	0.5451
	DINM	0.9312	0.7522	0.8417	0.5433	0.6040	0.7576	0.6350
	SKU*	0.6940	0.7247	0.7093	0.5350	0.4924	0.5736	0.5337
	MemFlex*	0.6397	0.8715	0.7556	0.2175	0.2148	0.3623	0.2649
	Neural Gate	0.9395	0.8440	0.8918	0.5750	0.5294	0.7946	0.6330
LLaVA	Baseline	0.5110	0.3669	0.4390	0.6000	0.7181	0.8513	0.7231
	MEMIT	0.7843	0.5443	0.6643	0.5783	0.7042	0.8223	0.7016
	AlphaEdit	0.8049	0.4525	0.6287	0.5967	0.6962	0.8366	0.7098
	DINM	0.9402	0.6972	0.8187	0.6133	0.7291	0.8540	0.7321
	SKU*	0.6579	0.6330	0.6455	0.5850	0.7051	0.8500	0.7134
	MemFlex*	0.6211	0.6697	0.6454	0.5750	0.6870	0.8460	0.7027
	Neural Gate	0.9610	0.7522	0.8566	0.6000	0.7135	0.8556	0.7230

Safety Avg represents the mean of PrivacyPair-test and MLLMGuard, and Utility Avg represents the mean of ScienceQA, MME, and POPE. Neural Gate achieves the highest Safety Avg on both models, while maintaining a Utility Avg comparable to the strongest baseline (0.7230 vs 0.7321 for DINM on LLaVA). On the out-of-distribution safety benchmark MLLMGuard, Neural Gate outpaces DINM by approximately 9.2 percentage points on MiniGPT (0.8440 vs 0.7522), indicating that the gating mechanism significantly bolsters cross-scenario generalization. Although MemFlex* yields a high score on MLLMGuard (0.8715), its Utility Avg collapses to 0.2649, because the model rejects nearly all queries, which is fundamentally an overfit to refusal behavior.

Ablation Study¶

Model	Layer Config	Gate	PrivacyPair-test \(\uparrow\)	MLLMGuard \(\uparrow\)	Safety Avg \(\uparrow\)	Utility Avg \(\uparrow\)
MiniGPT	Single Layer	w/o	0.9014	0.6147	0.7581	0.6042
MiniGPT	Single Layer	w/	0.9395	0.8440	0.8918	0.6330
MiniGPT	Multi-layer	w/o	0.7391	0.9082	0.8237	0.4241
MiniGPT	Multi-layer	w/	0.9213	0.7476	0.8345	0.4553
LLaVA	Single Layer	w/o	0.9550	0.7156	0.8353	0.7321
LLaVA	Single Layer	w/	0.9610	0.7522	0.8566	0.7230
LLaVA	Multi-layer	w/o	0.9775	0.7614	0.8695	0.7211
LLaVA	Multi-layer	w/	0.9823	0.8715	0.9269	0.7249

When Neural Gate is removed, the Safety Avg of multi-layer edited MiniGPT falls from 0.8345 to 0.8237, though the MLLMGuard score rises to 0.9082 instead. This is due to the model overfitting to blind refusal in the absence of gating constraints (where the Utility Avg plummets from 0.4553 to 0.4241, with MME at only 0.1844 and POPE at 0.4880). This safety improvement is effectively a false positive. LLaVA exhibits lower sensitivity to gate removal because its strongly active neurons are more stably distributed across layers, giving multi-layer editing a natural regularizing effect. Joint multi-layer editing achieves the best overall performance on LLaVA (Safety Avg 0.9269, Utility Avg 0.7249), whereas single-layer editing outperforms multi-layer on MiniGPT, which is analyzed as being caused by the highly fluctuating proportions of strongly active neurons across MiniGPT layers, leading to inter-layer editing interference.

Key Findings¶

Gating is the core contribution, yielding non-trivial gains: Removing Neural Gate causes the privacy protection performance (EtA) of MiniGPT single-layer editing to decline from 0.9395 to 0.9014, a drop of about 4%. Although the Safety Avg of multi-layer editing seems comparable, the Utility Avg drops drastically (0.6330 vs 0.4553), proving that gating not only boosts safety but also preserves utility.
Generalization stems from concept acquisition rather than data memorization: Keyword matching guardrails yield a refusal rate of only 17.43% on MLLMGuard, whereas Neural Gate exceeds 75%. This indicates that the model truly learns the privacy concepts rather than rote-memorizing training data.
Selectivity in privacy category generalization: Queries on trade secrets are successfully rejected (likely due to conceptual overlap with government document privacy in the training set), but drone-related queries are still answered. This suggests that representations of certain unseen privacy types are not fully captured, leading to uneven generalization coverage.
Layer localization is highly sensitive to performance: The proportion of strongly active neurons exhibits an inter-layer trend that first increases and then decreases. The optimal editing layer resides in the early-to-mid layers (Layer 6 for MiniGPT, Layer 11 for LLaVA), and editing performance degrades as it deviates from these layers.

Highlights & Insights¶

Using 'measurement' instead of 'assumption' to localize privacy neurons: Unlike prior methods that empirically select layers or edit all layers, Neural Gate utilizes a learnable vector \(m_l\) to measure the causal contribution of each neuron to the privacy target dimension-by-dimension. This transforms an empirical problem into data-driven neuron selection, which can transfer to other scenarios requiring fine-grained control over model internal behaviors (e.g., bias mitigation, hallucination suppression).
The three-tier neuron classification framework reveals the sparse nature of privacy representations: Separating inactive, weakly active, and strongly active neurons serves not only gated design but also provides an analytical tool to understand the privacy encoding mechanism of LVLMs. The discovery that strongly active neurons constitute less than 10% of dimensions directly explains why global editing methods are prone to overfitting: more than 90% of dimensions are contaminated by noisy gradients.
Design philosophy of paired datasets: isolating target signals with minimal contrasts: The design of PrivacyPair, possessing items differing by only one attribute word, is extremely restrained. Yet, this restraint ensures that privacy-sensitive signals remain undistracted by confounding factors such as syntax, image content, or subject categories. This construct of "minimal contrastive pairs" offers valuable reference for any analytical task requiring the isolation of specific model behaviors.
Gated truncation rather than projection or regularization: Neural Gate applies hard truncation (gradients set to zero) directly to weakly active and inactive neurons, rather than soft weighting or regularization constraints. This hard decision prevents weak signals from accumulating noise, yielding purer editing signals. Hard gating is most prominent in single-layer editing, hinting that sparse hard selection may outperform soft fusion in local editing scenarios.

Limitations & Future Work¶

Uneven coverage of privacy categories: The authors acknowledge that Neural Gate still fails to refuse effectively on certain out-of-distribution privacy categories (such as drones), leading to inconsistent generalization across privacy categories. The root cause is likely the varying conceptual similarity between different privacy classes: trade secrets share semantic features with government documents in the training set, whereas drones lack overlap with any training categories.
Evaluation limited to two 7B-level models: Experiments are conducted on MiniGPT-4-llama2-7b and LLaVA-1.5-7b, both based on a 7B LLM backbone. The distribution patterns and gating effects of strongly active neurons in larger models (e.g., 13B, 70B) or other architectures (e.g., Qwen- or Gemma-based LVLMs) remain to be validated.
PrivacyPair contains only 6 categories of privacy subjects: The coverage of privacy subjects is limited, and they are generated entirely using English query templates. Privacy queries in real-world deployment scenarios are considerably more diverse (including multilingual, implicit extraction, and progressive induction in multi-round dialogues). The robustness of the current method across different languages and interaction modes remains unknown.
Doubt on the universality of the gating threshold: The 30% threshold is empirically selected based on the 6 subject categories and two models. This threshold may require recalibration when privacy subjects expand or model architectures change. A potential direction for improvement is treating the threshold as a learnable parameter or designing an adaptive thresholding strategy.
Potential improvements: (1) Introduce contrastive learning or prototype networks to enhance semantic alignment between different privacy classes, enabling weakly correlated categories to share privacy refusal capabilities; (2) Extend single-layer gating to cross-layer attention-based gating, letting gating vectors from different layers interact via self-attention to mitigate the inter-layer fluctuations in MiniGPT; (3) Incorporate red-teaming adversarial training to introduce adversarial privacy queries during editing, thereby expanding the coverage of gating.

vs DINM (Detoxifying Model Editing): DINM performs full-dimensional editing on FFN parameters to reduce toxicity, relying on fixed editing layers and full gradient updates. The difference of Neural Gate lies in first identifying a subset of privacy-related neurons through feature measurement, and then updating gradients solely on this subset. Experiments reveal that this difference leads to a significant leap in generalization (+9.2% on MLLMGuard), indicating that for safety alignment tasks necessitating cross-context generalization, "pinpoint localization + restricted update" is superior to "exhaustive editing".
vs SKU / MemFlex (Knowledge Unlearning): Unlearning methods typically rely on gradient ascent to push away output distributions, which can easily induce collateral damage on benign queries through global distribution shifts. This paper replaces the unlearning target with explicit refusal prefix guidance (targeted training) and compresses the modification range to a subset of strongly active neurons via gated truncation, fundamentally minimizing side effects.
vs MEMIT / AlphaEdit (Knowledge Editing): Traditional knowledge editing fails in same-subject, dual-target scenarios like PrivacyPair, where two categories of queries (sensitive vs. benign) for the same subject demand opposing editing directions, which cancel each other out upon direct application. Neural Gate circumvents this conflict by disentangling privacy signals from general semantic signals via gating.

Rating¶

Novelty: ⭐⭐⭐⭐ The concept of neuron-level gradient gating is novel in the field of LVLM privacy protection. The three-stage pipeline (measurement-classification-gating) of privacy features possesses originality, although the gating mechanism itself borrows mask ideas from model editing and pruning, meaning the macro paradigm is not entirely initiated from scratch.
Experimental Thoroughness: ⭐⭐⭐⭐ The paper evaluates six baselines across two mainstream LVLMs, covering safety and utility dimensions, ablation studies, hyperparameter sensitivity analysis, generalization analysis, and a case study. The limitation lies in only evaluating 7B models, with a lack of validation on larger scale models.
Writing Quality: ⭐⭐⭐⭐ The structure is clear and the motivational chain is complete (pain points -> mechanism -> outcomes). The design of PrivacyPair and the logic flow of "feature measurement -> three-tier classification -> gating construction" in the analysis section progress naturally. The appendix supplies sufficient experimental details.
Value: ⭐⭐⭐⭐ This work provides an analysis-driven pinpoint-editing paradigm for safety alignment in LVLMs—measuring before editing rather than directly editing. This concept can be generalized to more safety scenarios such as hallucination suppression and bias mitigation. With open-source code and public PrivacyPair dataset, it holds high practical value.